How to Stop Unauthorized Payments From Your Bank Account (US Guide)

An unfamiliar debit on your bank statement can be a stolen-card purchase, an unauthorized electronic transfer, a forgotten subscription, or a merchant descriptor you do not recognize. Those situations need different remedies. This US-focused guide explains how to stop further losses, preserve your rights, and dispute the correct type of payment without assuming every unwanted charge is legally unauthorized.

Act now: If money is leaving your account without permission, contact your bank or credit union through its official app or the number printed on your card. Ask to report an unauthorized transaction, secure the account, and receive a case number. Do not wait for the merchant to reply when fraud is suspected. The Consumer Financial Protection Bureau (CFPB) explains the federal error-resolution process.

First, identify the type of payment

A payment label is not proof of fraud. Merchants may bill under a parent-company name, and some transactions initially appear as temporary authorizations. Check the transaction date, amount, card ending, receipt and any family or joint-account access, but do not delay reporting an actual suspicious withdrawal while investigating.

The first 15 minutes: contain the damage

1. Open the bank app directly—not a link in an alert—and capture the transaction amount, posting date, descriptor and reference number.
2. Call the fraud team using a verified number. Describe the transaction as unauthorized only if you did not make or permit it.
3. Request a block or replacement for a compromised debit card; ask whether the bank can block a specific merchant or ACH originator.
4. Secure access: change your banking password from a trusted device, revoke unfamiliar sessions, enable multifactor authentication, and review linked payment apps.
5. Check recent history: tiny test transactions and other unexpected transfers can indicate wider compromise.
6. Record the report: date, representative, case number, promised follow-up, and instructions for written confirmation.

A card lock can stop some new card purchases but may not stop ACH debits, previously authorized recurring transactions, or account-to-account transfers. Ask the bank which payment rails are affected and what additional action is required.

Know the US rules: Regulation E is not a blanket refund guarantee

For many consumer electronic fund transfers—including debit-card payments, ATM withdrawals, and ACH debits—Regulation E provides error-resolution and liability protections. The specific facts matter: when you discovered a lost card, when you told the bank, whether the transfer was actually authorized, and when a statement was sent.

The two-business-day rule for lost or stolen access devices

If an accepted debit card or similar access device is lost or stolen, notifying the institution within two business days after learning of the loss generally limits potential liability to the lesser of $50 or the unauthorized transfers. Delaying can increase exposure under applicable conditions. These rules are described in 12 CFR §1005.6. The two-day clock is tied to learning of the loss or theft—not automatically to the transaction date.

The 60-day statement rule

When an unauthorized electronic transfer appears on a periodic statement, the relevant reporting rule generally looks to 60 days after the institution sends that statement, not simply 60 days after the purchase. Late notice can affect liability for certain subsequent unauthorized transfers; it does not automatically mean every earlier transaction becomes your responsibility. Report immediately rather than trying to calculate the last safe day.

Investigation, provisional credit and extensions

A bank generally must investigate an error claim within 10 business days. Depending on the type of account or transfer and the investigation, the rules may allow longer periods if the institution provisionally credits the account and meets other conditions. For some new accounts, point-of-sale debit-card transactions or foreign-initiated transfers, different extended timelines may apply. Do not promise yourself a guaranteed 10-day refund. See the CFPB consumer explanation and §1005.11.

A decision tree: fraud, subscription, mistaken transfer or scam?

Case A: someone else initiated the transfer

If someone stole your credentials and initiated an electronic transfer without your authority, tell the bank exactly that. The CFPB explains that an unauthorized transfer may remain unauthorized even if a fraudster tricked you into sharing account-access information and then used it. The bank should investigate based on the facts, not simply reject a claim because credentials were involved. CFPB Electronic Fund Transfers FAQs.

Case B: you personally sent money after being deceived

If you initiated a payment yourself—for example, you sent money to a fake seller after a persuasive message—the transaction may be treated differently from a transfer initiated by a thief. Report the scam and request recovery immediately, but do not claim that you did not authorize a transfer you actually sent. Ask whether recall, reversal, payment-network protection or another dispute channel is available. Eligibility depends on facts and payment method.

Case C: a subscription you agreed to keeps charging

An auto-renewal you previously accepted is not automatically an unauthorized EFT just because you no longer want it. Cancel through the merchant’s official process and keep a dated screenshot or email. If the company bills after a valid cancellation or never obtained consent, dispute the charge with your payment provider and explain the history. The FTC guide to subscriptions recommends retaining records and monitoring statements.

Case D: recurring ACH debit from a company

For a preauthorized electronic transfer, Regulation E §1005.10 generally permits stopping payment by notifying the bank at least three business days before the scheduled debit. Banks may require written confirmation after an oral request, under the rule’s conditions. Revoking a merchant’s authorization and instructing the bank to stop an EFT are related but distinct steps; do both where appropriate.

How to dispute an unauthorized bank withdrawal step by step

1. Contact the bank or credit union immediately, state the exact disputed amount and date, and say why you believe it was unauthorized.
2. Ask the bank to open an electronic-fund-transfer error investigation, when applicable, and give you a confirmation number.
3. Submit any requested written details promptly, but do not assume the bank can refuse to begin investigating until you contact the merchant.
4. Provide screenshots of the statement, any fraud alerts, and evidence that the merchant or recipient is unknown to you. Avoid sending passwords or complete card numbers by ordinary email.
5. Ask whether the bank will provide provisional credit and when it expects to decide. Understand that provisional credit may later be reversed if the claim is denied.
6. Check the written decision and all supporting transactions; if the explanation is wrong, request the documents relied upon and consider a CFPB complaint.

A bank-dispute message you can adapt

Subject: Unauthorized electronic transfer — request for investigation

I am reporting an electronic transfer on my account that I did not make or authorize. The transaction posted on [date] for [$amount] and appears as [descriptor/reference]. I discovered it on [date]. Please investigate this as an error under applicable law, help prevent further unauthorized transfers, and confirm my claim number and next steps. I can provide supporting documentation through your secure channel. Please send the outcome in writing.

If you did authorize the payment but believe the merchant violated a cancellation agreement, replace the claim description with accurate facts. A clear, truthful timeline helps the bank apply the correct rules.

Three worked examples: which path makes sense?

Example 1: a $12 test charge followed by a $430 debit

You notice two unfamiliar debit-card charges and still have the physical card. Treat both as suspicious, contact the issuer immediately, request card replacement, and check for more activity. A small test charge can precede larger fraud, but that pattern alone does not prove who made the payment. Preserve both transaction IDs.

Example 2: a $19.99 renewal after cancellation

You canceled a streaming service on September 5 and were charged again on October 5. Gather the cancellation confirmation, plan terms and statement. Contact the merchant for correction and ask the bank about a charge dispute if the merchant refuses. Do not present it as card theft unless your details were actually used without permission.

Example 3: a fake bank agent obtains your password

A caller posing as bank security persuades you to disclose a login code. Later, a third party transfers $1,200. Tell the real bank exactly how the credentials were obtained and who initiated the transfer; ask for a Regulation E investigation. The CFPB specifically addresses transfers initiated by fraudsters using access information obtained through deception. Change credentials and review connected devices immediately.

What if the bank denies your claim?

• Request the written explanation and the documents the bank relied on, where applicable.
• Compare the denial reason with your evidence: Did the bank confuse a stolen-login transfer with a payment you personally sent?
• Correct factual errors in writing, keeping a dated copy.
• File a complaint through CFPB’s complaint portal if the bank does not resolve the issue.
• If identity theft is involved, use IdentityTheft.gov for a tailored recovery plan.
• For complex or large losses, consider qualified legal advice in your state.

A complaint does not guarantee reimbursement, and the CFPB does not decide every private dispute. It can, however, provide a documented channel for the company’s response.

How to prevent repeat unauthorized debits

• Turn on instant transaction notifications for cards and accounts.
• Use unique passwords and multifactor authentication; avoid approving unexpected login prompts.
• Review automatic-payment authorizations at least quarterly.
• Consider a dedicated payment card for subscriptions if your bank supports one.
• Never share one-time passcodes with a caller claiming to be fraud support.
• Use bank contact details from its official app or your physical card, not from search ads or text messages.

Common mistakes that can weaken a dispute

Waiting for a refund promise: Contacting a merchant can help with a billing mistake, but suspected fraud should be reported to the bank promptly. Assuming a card lock stops everything: ACH and recurring debits may need separate instructions. Using the wrong legal label: Distinguish an unauthorized transfer from a regretted authorized purchase. Deleting evidence: Save messages, screenshots, statements and case numbers before blocking accounts. Assuming every payment method has identical protections: Debit, credit, wire, check and app payments can follow different rules.

Official sources and next steps

Primary references: CFPB: Unauthorized bank transactions; Regulation E: Consumer liability; Regulation E: Error resolution; CFPB: EFT FAQs; FTC: Recurring subscriptions.

The fastest useful sequence is secure the account → report the exact transaction → preserve proof → identify the correct dispute category → follow up in writing. US federal protections depend on the type of payment and the facts. This article is general consumer information, not individualized legal or financial advice.